CVE Vulnerability Catalog

In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In getXmlFileNameForUser of LocaleManagerService.java, there is a possible permission bypass due to a confusable path traversal. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple functions of MmiUtils.java, there is a possible risk of USSD/MMI code execution due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

In onActivityResult in multiple locations, there is a possible contact leak from protected profile due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In ShortcutInfo of ShortcutInfo.java, there is a possible way to crash the launcher via unauthorized shortcuts due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed.

In onResult of AccountManagerService.java, there is a possible untrusted/misleading UI issue due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed.

In queryRemoteConnectionServices of ConnectionServiceWrapper.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed.

In multiple functions of MediaCarouselController.kt, there is a possible way for media to show up after disablement due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed.

In multiple functions of SaveUi.java, there is a possible bypass of package installation requirements due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed.

In onCreate of SettingsApplication.java, there is a possible cross-profile consent dialog label injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed.

In onStrongAuthRequiredChanged of UsbService.java, there is a possible unauthenticated enabling of USB data due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed.

In multiple locations, there is a possible denial of service due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed.

In multiple locations, there is a possible way to share files across profiles due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed.

In getRingtone of RingtoneFactory.java, there is a possible unprivileged access risk due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.

In writeGrantedUriPermissions of UriGrantsManagerService.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in H5B__iterate_helper() in src/H5B.c. When iterating a version 1 B-tree, the function does not verify that a child node's level matches the expected level, allowing a crafted HDF5 file to bypass the check and cause unbounded recursion, leading to stack exhaustion and a crash. This can be triggered by calling H5Gget_info() or H5Gget_num_objs() on a group in the crafted file.

Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB, allowing physical attackers to obtain an interactive shell as uid 2000 (system) without credentials. Attackers with physical access and a USB-to-TTL adapter can leverage this shell to reach the pppoe_wrapper vendor daemon, which contains an OS command injection vulnerability executed as root, resulting in full root-level compromise of the device.

The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService) on Nexbox A95X TV boxes contains an out-of-bounds write vulnerability in vob_fill_pixel(). A remote attacker can corrupt stack memory by sending a crafted SET_CONTR command with an attacker-controlled alpha value that drives an unbounded array index (change_data) past the end of the fixed four-element PixelDatas array. This can be exploited by sending malicious VobSub data over the unauthenticated tcp/10100 socket or via a malicious .sub file, resulting in silent stack corruption or process crash.

The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService) on Nexbox A95X TV boxes contains an infinite loop vulnerability in get_vob_spu(). An unauthenticated network attacker or local user loading malicious files can trigger an unreachable loop exit condition via mismatched length fields. This can be exploited by sending crafted AMLU data blocks over the unauthenticated tcp/10100 listener or via a malicious VobSub (.sub) file, causing the subtitle decode thread to spin at 100% CPU indefinitely, resulting in denial of service.